Mpjs[,dZddlmZdZddlZddlZddlZddlZddlZddl Z ddl Z ddl Z e jje jje jjeZe jje jj%edZeejvrejj)deddlmZddlmZmZmZmZmZmZddlmZdd l m!Z!ejDd Z#Gd d e$Z%e%jLd e%jNde%jPde%jRde%jTde%jVde%jXdiZ-dZ.Gdde$Z/Gdde$Z0dZ1e2dk(re1yy)aT oleid.py oleid is a script to analyze OLE files such as MS Office documents (e.g. Word, Excel), to detect specific characteristics that could potentially indicate that the file is suspicious or malicious, in terms of security (e.g. malware). For example it can detect VBA macros, embedded Flash objects, fragmentation. The results is displayed as ascii table (but could be returned or printed in other formats like CSV, XML or JSON in future). oleid project website: http://www.decalage.info/python/oleid oleid is part of the python-oletools package: http://www.decalage.info/python/oletools )print_functionz0.60.1Nz..) tablestream)cryptoftguessolevbamraptoroleobjooxml) log_helper)get_codepage_nameoleidc,eZdZdZdZdZdZdZdZdZ dZ y ) RISKz# Constants for risk levels HIGHMediumlownoneinfoUnknownErrorN) __name__ __module__ __qualname____doc__rMEDIUMLOWNONEINFOUNKNOWNERROR\/mnt/ssd/data/Dropbox/adrian/scripts/msg_venv/lib/python3.12/site-packages/oletools/oleid.pyrros, D F C D DG Er"rredyellowwhitegreencyancg}tjd|D]}|j}|dzt|kDr%|||dz}t j d||dz|dzd}|dkDrUt j d||dz|dzd}||zt|kDs|d kr||||z}d }d |vrd }|dd } t j| |j|||f|S#t$rYwxYw)a7 Detect Flash objects (SWF files) within a binary string of data return a list of (start_index, length, compressed) tuples, or [] if nothing found. Code inspired from xxxswf.py by Alexander Hanel (but significantly reworked) http://hooked-on-mnemonics.blogspot.nl/2011/12/xxxswfpy.html sCWS|FWSz>A #^#e#e )$$&H  IIHMr"ctddddtj}|jj ||j sy|j j drd|_tj|_ |S)a  Check whether this file contains an ObjectPool stream. Such a stream would be a strong indicator for embedded objects or files. :returns: :py:class:`Indicator` for ObjectPool stream or None if file was not opened ObjectPoolFzlContains an ObjectPool stream, very likely to contain embedded OLE objects or files. Use oleobj to check it.)rHrIrJNT) rCrrrar7r_existsrFrrJ)rLobjpools r#r~zOleID.check_object_poolsi %lQ  w'xx 88??< ( GM88GLr"c $tddtddtjd}|jj |tddtdd tjd}|jj ||j jtjjk(rd |_ d |_ ||fSd } tj|j|j }|j!rd|_tj$|_d|_ |j)}t+j,|}|j/|j0r#d|_tj2|_d|_ ||j9d }|j j;r|j<rn tj|j}|j?r#d|_tj$|_d|_ ||j9||fS||fStj@|_d|_d|_ ||fS#t4$r:}tj6|_d|_dt|z|_ Yd }~ d }~wwxYw#||j9d }wxYw#t4$r9}tj6|_d|_dt|z|_ Yd }~d }~wwxYw#||j9wwxYw)zy Check whether this file contains macros (VBA and XLM/Excel 4). :returns: :py:class:`Indicator` vbaNoz VBA Macrosz&This file does not contain VBA macros.F)rMrFrNrHrIrJrKxlmz XLM Macrosz.This file does not contain Excel 4/XLM macros.z#RTF files cannot contain VBA macrosz#RTF files cannot contain XLM macrosN)r`r8YeszeThis file contains VBA macros. No suspicious keyword was found. Use olevba and mraptor for more info.zYes, suspiciouszdThis file contains VBA macros. Suspicious keywords were found. Use olevba and mraptor for more info.rz#Error while checking VBA macros: %s)r`z:This file contains XLM macros. Use olevba to analyse them.z#Error while checking XLM macros: %srzIFor now, XLM macros can only be detected for files on disk, not in memory)!rCrwrrrar7rorprrqRTFrIr VBA_Parserr`r8detect_vba_macrosrFrrJget_vba_code_all_modulesr MacroRaptorscan suspiciousrr6r ris_excelrVdetect_xlm_macrosr)rL vba_indicator xlm_indicator vba_parservba_codemes r#r|zOleID.check_macross "e4s.V'+yyG  }-!e4s.^'+yyG  }- 88   1 1 1(MM %(MM % -/ /  **DMM RJ++-&+ #%)[[ "-T )%>>@''1<<*;M')-M&1WM- %  "J 88      +!'!2!2DMM!JJ!335.3 +-1[[ *4p 1 "-"((* m++}m++ &*\\ "&/ #,w )m++? W!%M ")M (MPSTUPV(VM % % W %  "J!_)-M&*1M'0UX[\]X^0^M--_ "-"((*.sVCIAJ5 J/JJJJJ25 K7>/K2-K:2K77K::Lctddtddtj}|jj ||j sy|j jD]T}|j j|j}t|}|xjt|z c_ V|jdkDrtj|_|S)z Check whether this file contains flash objects :returns: :py:class:`Indicator` for count of flash objects or None if file was not opened flashrz Flash objectszvNumber of embedded Flash objects (SWF files) detected in OLE streams. Not 100% accurate, there may be false positives.rN)rCrrrrar7r_listdir openstreamrXrArFr1rrJ)rLrstreamr8r9s r#rzOleID.check_flashs Qc%  u%xxhh&&( &F88&&v.335D &E KK3u: %K  & ;;?EJ r")NN) rrrrrOrhrrzr{r}r~r|rr!r"r#rRrRs8 !D.`)6882A,Fr"rRc Vtdtztdtdtdtjt}|j dt ddd |j}t|jd k(r|jy tj|jD]}td |t|}|j}tj gdgdtj"}|D]~}|j$r |j&st(j+|j,d }|j/|j0|j&|j,|j2f|||d f|j5y )zFCalled when running this file as script. Shows all info on input file.z(oleid %s - http://decalage.info/oletoolsz3THIS IS WORK IN PROGRESS - Check updates regularly!zGPlease report any issue at https://github.com/decalage2/oletools/issuesrk)rIinput*FILEzName of files to process)rGnargsmetavarhelprNz Filename:)r-r- )rCValueRisk Description) header_rowstyle)colors)print __version__argparseArgumentParserr add_argumentrw parse_argsr1r print_helpr enable_loggingrRrr TableStreamTableStyleSlimSeprKrF risk_colorgetrJ write_rowrHrIr)parserargsr`r ratablerfcolors r#mainrsh 4{ BC ?@  9: "I  $ $ 9F cf79    D 4::!JJ k8$h[[] ''(83`.9.K.KM$ DI++IOO"y~~t<)..R[RgRg h(-ueT'B D  D  r"__main__)3r __future__rrrsysr.r4r2osrYr]pathnormpathabspathdirname__file___thismodule_dirr _parent_dirinsertoletools.thirdparty.tablestreamroletoolsrrrrr r oletools.common.log_helperr oletools.common.codepagesr get_or_create_silent_loggerrobjectrrrrrrrr rrArCrRrrr!r"r#rsKV&$ */...''""277??277??83L#MNggrww||OTBC chhHHOOA{#7DD17-j,,W5 6  IIuKKHHgIIwIIvLL$JJ 0j++(kFk` 'R zFr"